ID CVE-2017-8907
Summary Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so. An attacker who can login to Bamboo as a user without the edit permission for deployment projects is able to use this vulnerability, provided there is an existing plan with a green build, to create a deployment project and execute arbitrary code on an available Bamboo Agent. By default a local agent is enabled; this means that code execution can occur on the system hosting Bamboo as the user running Bamboo.
References
Vulnerable Configurations
  • cpe:2.3:a:atlassian:bamboo:5.0:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.0:beta1:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.0:beta1:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.0:beta2:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.0:beta2:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.0:beta3:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.0:beta3:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.1:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.2:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.2:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.3:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.3:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.4:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.4:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.5:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.5:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.6:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.6:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.6.2:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.7:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.7:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.7.1:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.7.2:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.7.2:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.8:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.8:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.8.1:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.8.1:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.8.2:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.8.2:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.8.5:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.8.5:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.9:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.9:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.9.1:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.9.1:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.9.2:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.9.2:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.9.3:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.9.3:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.9.4:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.9.4:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.9.7:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.9.7:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.11.3:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.11.3:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.12.0:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.12.0:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.12.1:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.12.1:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.12.2:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.12.2:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.12.4:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.12.4:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.12.5:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.12.5:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.13.0:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.13.0:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.13.1:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.13.1:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.13.2:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.13.2:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.14.0:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.14.0:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.14.1:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.14.1:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.14.2:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.14.2:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.14.3:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.14.3:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.14.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.14.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.14.5:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.14.5:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.15.0:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.15.0:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.15.2:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.15.2:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.15.3:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.15.3:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.15.4:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.15.4:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:5.15.5:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:5.15.5:*:*:*:*:*:*:*
  • cpe:2.3:a:atlassian:bamboo:6.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:atlassian:bamboo:6.0.0:*:*:*:*:*:*:*
CVSS
Base: 6.5 (as of 03-10-2019 - 00:03)
Impact:
Exploitability:
CWE CWE-863
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:S/C:P/I:P/A:P
refmap via4
bid 99090
confirm https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-06-14-907283498.html
Last major update 03-10-2019 - 00:03
Published 14-06-2017 - 20:29
Last modified 03-10-2019 - 00:03
Back to Top